fix(security): remediate CVE vulnerabilities

[upbound-bot]

Summary

This PR fixes CVE vulnerabilities identified by security scanning.

Vulnerabilities Fixed

CVE/GHSA	Severity	Package	Fixed Version
CVE-2025-68121	Critical	stdlib	go1.24.13
CVE-2025-61726	High	stdlib	go1.24.13
CVE-2025-61731	High	stdlib	go1.24.13
CVE-2025-61732	High	stdlib	go1.24.13
CVE-2025-61728	Medium	stdlib	go1.24.13
CVE-2025-61730	Medium	stdlib	go1.24.13

Changes Made

• Update Go version from 1.24.11 to 1.24.13 in go.mod

References

• CVE-2025-68121
• CVE-2025-61726
• CVE-2025-61731
• CVE-2025-61732
• CVE-2025-61728
• CVE-2025-61730

Verification

• Rescanned with cve-scan skill after fixes
• All listed vulnerabilities resolved

[upbound-bot]

Build Failure Analysis

Check: unit-test
Status: Failed
Analyzed: 2026-02-27T00:04:00Z

Summary

The unit-test job failed because Go 1.24.11 cannot build a module that requires Go 1.24.13.

Root Cause

The CI workflow is configured to use Go 1.24.11 (GO_VERSION env variable), but go.mod was updated to require Go 1.24.13 as part of CVE remediation. The GOTOOLCHAIN=local setting in the workflow prevents automatic toolchain upgrade.

Error Details

go: go.mod requires go >= 1.24.13 (running go 1.24.11; GOTOOLCHAIN=local)

Recommendation

Update GO_VERSION in .github/workflows/ci.yml from 1.24.11 to 1.24.13 to match the go.mod requirement.

---

_{This analysis was generated by the build-failure-analyze skill.}

[upbound-bot]

Build Failure Analysis

Check: lint
Status: Failed
Analyzed: 2026-02-27T00:04:00Z

Summary

The lint job failed because Go 1.24.11 cannot run go mod tidy on a module that requires Go 1.24.13.

Root Cause

The CI workflow is configured to use Go 1.24.11 (GO_VERSION env variable), but go.mod was updated to require Go 1.24.13 as part of CVE remediation. The GOTOOLCHAIN=local setting in the workflow prevents automatic toolchain upgrade.

Error Details

go: go.mod requires go >= 1.24.13 (running go 1.24.11; GOTOOLCHAIN=local)

Recommendation

Update GO_VERSION in .github/workflows/ci.yml from 1.24.11 to 1.24.13 to match the go.mod requirement.

---

_{This analysis was generated by the build-failure-analyze skill.}

[upbound-bot]

Build Failure Analysis

Check: build (amd64)
Status: Failed
Analyzed: 2026-02-27T00:04:00Z

Summary

The Docker build failed because the golang:1.24.11 base image cannot build a module that requires Go 1.24.13.

Root Cause

The CI workflow passes GO_VERSION=1.24.11 as a Docker build arg, which selects the golang:1.24.11 base image. However, go.mod was updated to require Go 1.24.13 as part of CVE remediation. The GOTOOLCHAIN=local setting in the container prevents automatic toolchain upgrade.

Error Details

#15 0.056 go: go.mod requires go >= 1.24.13 (running go 1.24.11; GOTOOLCHAIN=local)
ERROR: failed to solve: process "/bin/sh -c go mod download" did not complete successfully: exit code: 1

Recommendation

Update GO_VERSION in .github/workflows/ci.yml from 1.24.11 to 1.24.13 to match the go.mod requirement.

---

_{This analysis was generated by the build-failure-analyze skill.}